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What is claimed is: 

1 . A method of monitoring a wireless network, the method comprising the steps 
of: 

(a) receiving a data unit from a wireless node; 

(b) if a bandwidth constraint is satisfied, buffering the received data unit; 
and 

(c) transmitting the received or buffered data unit to a monitoring processor. 

2. The method of claim 1, and further comprising the steps of receiving the 
bandwidth constraint. 

3. The method of claim 2, wherein the bandwidth constraint is received from a 
local data store, a wired network node, a wireless network node, an access point 
or a sensor. 

4. The method of claim 2, and further comprising the step of requesting the 
bandwidth constraint. 

5. The method of claim 1 , and further comprising the step of determining the 
bandwidth constraint. 

6. The method of claim 5, wherein the step of determining the bandwidth 
constraint is based at least in part upon local data, data received from a wired 
network node, data received from a wireless network node, data received from 
an access point, data received from a sensor or combinations thereof. 

7. The method of claim 1, and further comprising the step of downsampling when 
the bandwidth constraint is satisfied. 

8. The method of claim 7, wherein the step of downsampling occurs when a local 
storage constraint is satisfied. 

9. The method of claim 8, wherein the step of downsampling only occurs when the 
local storage constraint is satisfied. 

1 0. The method of claim 7, wherein the step of downsampling comprises one or 
more steps selected from the group consisting of: 

(i) discarding the received data unit if it is redundant with a 
previously buffered data unit; 
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(ii) aggregating the received data unit with a previously buffered 
data unit; 

(iii) discarding the received data unit if it comprises network control 
data; 

(iv) discarding the received data unit if it is associated with a device 
that has already been observed more frequently than other 
devices; and 

(v) discarding the received data unit if the wireless node is 
determined to be a low threat node. 

1 1 . The method of claim 1 , and further comprising the step of repeating steps (a) 
through (c) for a plurality of wireless nodes. 

12. The method of claim 11, and further comprising the step of selecting the 
wireless node from the plurality for a given repetition. 

13. The method of claim 12, wherein the selecting step is based upon random 
selection. 

14. The method of claim 12, wherein the selecting step is based upon a 
deterministic selection. 

15. The method of claim 14, wherein the deterministic selection is a sequential 
traversal of the plurality, a selection based upon amount of buffered data for 
each wireless node in the plurality, a selection based upon a threat level for each 
wireless node in the plurality or combinations thereof. 

1 6. The method of claim 1 1 , wherein the transmitting step occurs at a rate 
determined based upon the bandwidth constraint and current bandwidth useage. 

17. The method of claim 1, and further comprising the step of repeating steps (a) 
through (c) for a plurality of received data units from the wireless node. 

18. The method of claim 17, wherein the transmitting step occurs at a rate 
determined based upon the bandwidth constraint and current bandwidth useage. 

19. The method of claim 1, wherein the transmitting step occurs at a time based 
upon whether the bandwidth constraint is satisfied. 
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20. The method of claim 19, wherein the transmitting step comprises immediately 
transmitting the received data unit if the bandwidth constraint is not satisfied. 

21 . The method of claim 1 9, wherein the transmitting step further comprises 
transmitting the buffered data unit at a point in time when the bandwidth 
constraint is not satisfied. 

22. One or more computer readible media storing instruction that upon execution by 
a system processor cause the system processor to monitor a wireless network by 
performing the methods of any of claims 1 through 21. 

23. A system of monitoring a wireless network, the system comprising: 

(a) a system data store (SDS) comprising capable of storing wireless data 
transmitted by a wireless node and configuration information at least 
comprising a bandwidth constraints; 

(b) a wireless receiver capable of receiving one or more data units from a 
wireless node; 

(c) a communication interface allowing communication with a monitoring 
processor; and 

(d) a system processor in communication with the SDS, the wireless 
receiver and the communication interface, wherein the system processor 
comprises one or more processing elements programmed or adapted to: 

(i) receive a data unit from the wireless receiver in response to 
receipt of the data unit by the wireless receiver from a wireless 
node; 

(ii) buffer the received data unit in the SDS if a bandwidth constraint 
is satisfied; 

(iii) immediately transmit the received data unit to the monitoring 
process via the communication interface if the bandwidth 
constraint is not satisfied; 

(iv) repeat steps (i) through (iii) for a plurality of received data units; 

(v) discard the received data unit if the bandwidth constraint is 
satisfied, if a local storage constraint has been satisfied and if the 



76 

ATTORNEY DOCKET NO. 093615600016 

received data unit is redundant with a previously buffered data 
unit, comprises network control data, is associated with a device 
that has already been observed more frequently than other 
devices or originates from a low threat wireless node; 

(vi) aggregate the received data unit with a previously buffered data 
unit if the bandwidth constraint is satisfied and if the received 
data unit is compatible with the previously buffered data unit; 
and 

(vii) transmit a selected buffered data unit to the to the monitoring 
process via the communication interface at a point in time after 
receipt based upon the bandwidth constraint and bandwidth 
useage. 

24. A system of monitoring a wireless network, the system comprising: 

(a) receiving means for receiving a data unit from a wireless node; 

(b) buffer means for accepting for buffering a received data unit from the 
receiving means if a bandwidth constraint is satisfied, aggregating the 
accepted data unit with a previously buffered data unit if the accepted 
data unit is compatible with the previously buffered data unit, discarding 
the accepted data unit if a storage constraint is satisfied and if the 
accepted data unit is redundant with a previously buffered data unit, 
comprises network control data, is associated with a device that has 
already been observed more frequently than other devices or originates 
from a low threat wireless node; and 

(c) output means for immediately transmitting a received data unit to a 
monitoring processor if the bandwidth constraint is not satisfied and for 
transmitting a buffered data unit to the monitoring processor at a point in 
time after receipt based upon the bandwidth constraint and bandwidth 
useage. 



